23 July 2016

ECPA: Reality of Homegrown Violent Extremism...

In the United States, Operational Risk Management Executives in
the private sector are consistently balancing the legal requirements for
public safety and their customers right to privacy. The Internet
Service Provider (ISP) General Counsel's duty to facilitate the rule of
law within the private sector organization, has been on a collision
course with protecting the homeland for over a decade since 9/11.

One
of the critical tools for Homeland Security Intelligence (HSI) is the
"Electronic Communications Privacy Act (ECPA) and for good reason. The
law provides the tools for law enforcement and national security
intelligence analysts while simultaneously protecting the privacy
interests of all Americans. In a 2011 statement before
the Committee on Judiciary, United States Senate, Associate Deputy
Attorney General - James A. Baker outlines the basis for ECPA:

"ECPA
has never been more important than it is now. Because many criminals,
terrorists and spies use telephones or the Internet, electronic evidence
obtained pursuant to ECPA is now critical in prosecuting cases
involving terrorism, espionage, violent crime, drug trafficking,
kidnappings, computer hacking, sexual exploitation of children,
organized crime, gangs, and white collar offenses. In addition, because
of the inherent overlap between criminal and national security
investigations, ECPA’s standards affect critical national security
investigations and cyber security programs."

The
criminal elements and their organized syndicates are leveraging modern
day technologies and capabilities of the private sector. The legal
first responders for our 21st century homeland threats don't always wear
a badge and drive a Crown Vic on patrol around our city streets. Many
spend their hours on patrol in cyberspace or analyzing terabytes of data
online with sophisticated software to determine the what, who, why and
how of the current threat stream.

The
US government has a fiduciary and legal duty to protect the privacy and
civil liberties of all US citizens. Parallel to this task is the
rapidly changing use of communications and other mobile technologies to
facilitate and support the activities and operations of individuals and
networks of people, who exploit the design, configuration or
implementation of our countries homeland defense architecture.

Whether
this architecture includes the utilization of 72 Fusion Centers or the
methods for collecting "Suspicious Activity Reports" (SARS) from those
first responders, the fact remains that the pursuit of national security
threats is a lofty task. This is happening today, on the ground and in
the digital domain. Therefore, the speed that these individuals can
legally obtain the data they require to make informed decisions is at
stake and so we must eliminate any new impediments put before them.
From Mr. Bakers statement on "Government Perspectives on Protecting
Privacy in the Digital Age" he explains further:

Addressing
information associated with email is increasingly important to criminal
investigations as diverse as identity theft, child pornography, and
organized crime and drug organizations, as well as national security
investigations. Moreover, email, instant messaging, and social
networking are now more common than telephone calls, and it makes sense
to examine whether there is a reasoned basis for distinguishing between
the processes used to obtain addressing information associated with wire
and electronic communications. In addition, it is important to
recognize that addressing information is an essential building block
used early in criminal and national security investigations to help
establish probable cause for further investigative techniques. Congress
could consider whether this is an appropriate area for clarifying
legislation.

Any
changes to the ECPA laws should be considered carefully with not only
the government but the private sector. The combination shall work
together to find the correct balance between national security
requirements and the privacy of the customers of mobile communications,
e-mail, and social networking entities. The time that it takes our
first responders to rule-in or rule-out a person of interest in an
ongoing investigation can mean the difference between a failed or
successful attack on the homeland. The private sector shall determine
the prudent cost to the government for providing the legally obtained
information of non-telephone records such as a name, address and other
metadata. By the way, has anyone noticed that the criminals,
terrorists, spies and other malicious actors have decided to use Telegram, or WhatsApp instead of their mobile telephone?

Homeland
Security Intelligence (HSI) first responders will be the first to tell
you that the crime syndicates and non-state actors have gone underground
and have stopped using the tools that leave the data more easily
accessible by law enforcement. Now, they are creating and operating
their own private and secure infrastructures within the confines of
private sector companies. These clandestine groups have organized
hierarchy and specialized skills and therefore, the US government must
continue to step up the pace, legally.

What
does this all mean? It means that there will be a lower chance of
under cover law enforcement officers becoming members of the these
organized crime syndicates that in many cases are the genesis for
homegrown violent extremism (HVE).

Homegrown extremists can be individuals who become violently radicalized, perhaps after exposure to jihadi videos, sermons and training manuals available on the Internet, security officials say. Such plotters are harder for counterterrorism officials to spot because they have few links with known terrorist operatives and often don’t travel overseas for training.

Another
implication is that there is a higher chance that private sector
researchers will understand the new trade craft of HVE actors, long
before law enforcement and national security intelligence analysts.
This is because the standard approach to the "Seven Signs of Terrorism"
have been focused on the physical infrastructure. Organizations in the
private sector have been researching, tracking and profiling since the
late 1990's on the methods and modus operandi of the digital extremists
who have plagued our banks and other financial institutions with cyber
crime.

The time is now for these
two distinct disciplines and professionals to converge. The public as
eyes and ears combined with the legal tools to extract the timely
information from technology providers is part one. Part two is the
integration of intelligence analytic training
with the curriculum of the police and fire academies for new recruits.
Providing these first responders with the methods, tools and
capabilities to be more effective collectors on the street level, will
provide the fusion centers with a more robust set of relevant
information streams. Here is an example from a graduate certificate
class in criminal intelligence analysis from AMU:

The graduate certificate in Intelligence Analysis provides you with a fundamental understanding of the issues, problems, and threats faced by the intelligence community. This online graduate program helps you develop a comprehensive knowledge of how intelligence agencies in the U.S. assess and counter international threats in order to guard U.S. global interests and protect U.S. national security from adversaries. Knowledge from this certificate program is applicable to many career fields within the military, security companies, government contractors, or federal agencies.

We have a choice to provide our
first responders with the correct training and OPS Risk education for
today's Homeland Security Intelligence (HSI) mission. Our national
policy makers have a choice to assist them in getting the information
they need to do their jobs quickly, efficiently and while protecting
civil liberties. The choices that we make fifteen years after 9/11, will
define the landscape for homegrown extremism and the legal framework for
ensuring the safety and security of all Americans for years to come.

No comments:

Post a Comment

About

Operational Risk is defined as the risk of loss resulting from inadequate or failed processes, people, and systems or from external events. The definition includes legal risk, which is the risk of loss resulting from failure to comply with laws as well as prudent ethical standards and contractual obligations. It also includes exposure to litigation from all aspects of an institutions activities.

"The Only Thing Necessary For Evil To Triumph Is For Good Men To Do Nothing." --E. Burke